Palo Alto Networks has issued an urgent security advisory warning enterprises of a critical vulnerability in its PAN-OS software that is already being actively exploited in limited campaigns.
Tracked as CVE-2026-0300, the flaw carries a CVSS 4.0 base score of 9.3 and enables unauthenticated remote attackers to execute arbitrary code with full root privileges on affected firewall appliances.
The active exploitation status makes this one of the most pressing threats currently facing enterprise network security teams.
The vulnerability affects PA-Series and VM-Series firewalls worldwide, creating severe operational risk for organizations that rely on Palo Alto Networks infrastructure as their primary perimeter defense.
Security teams are being urged to act immediately, as patches are not yet universally available and exploitation activity continues to grow.
Inside the PAN-OS Buffer Overflow Flaw
The root cause of CVE-2026-0300 is a buffer overflow vulnerability residing in the User-ID Authentication Portal, commonly known as the Captive Portal service.
Classified under CWE-787 as an out-of-bounds write weakness, the flaw allows threat actors to completely compromise a targeted firewall appliance by sending specially crafted network packets directly to the vulnerable service.
What makes this vulnerability particularly dangerous is its exploitation profile. The attack vector is entirely network-based, requiring no user interaction, no prior authentication, and no administrative privileges.
This combination keeps the overall exploitation complexity extremely low, making the flaw highly automatable.
Threat actors can rapidly scan the internet for exposed endpoints and launch attacks at scale with minimal effort.
Security researchers have confirmed that active exploitation campaigns are already targeting Palo Alto Networks firewalls where the User-ID Authentication Portal remains exposed to untrusted IP addresses or the public internet.
Organizations that have not enforced standard network segmentation practices face the highest immediate risk.
The vulnerability was reportedly discovered in production environments, underscoring the speed at which sophisticated threat actors are leveraging network scanning techniques to identify and exploit newly disclosed weaknesses before patches are widely deployed.
The vulnerable PAN-OS branches span multiple software generations. Specific versions within PAN-OS 12.1, 11.2, 11.1, and 10.2 running on PA-Series and VM-Series appliances configured with the authentication portal are confirmed to be affected.
Administrators must carefully review their deployed versions to accurately assess their exposure.
On a positive note, Palo Alto Networks has confirmed that its cloud-based and management platforms, including Prisma Access, Cloud NGFW, and Panorama appliances, are not affected by this vulnerability and require no remediation action.
Palo Alto Networks is actively developing official firmware updates to permanently address CVE-2026-0300.
The patched releases are scheduled for a staggered rollout between May 13 and May 28, 2026, with the timeline varying depending on the specific PAN-OS version branch in use. Until those updates are available, administrators must deploy interim mitigations without delay.
The most effective immediate workaround is restricting access to the User-ID Authentication Portal so that it is only reachable from trusted internal network zones, effectively blocking any untrusted or internet-facing exposure.
Organizations that do not strictly depend on the Authentication Portal for daily operations should consider disabling the service entirely until patches are applied.
For environments running PAN-OS 11.1 or later, Palo Alto Networks has released a dedicated Threat Prevention Signature designed to actively detect and block malicious network traffic attempting to exploit this buffer overflow weakness.
Deploying this signature provides an additional defensive layer while awaiting the official firmware fix.
Given the confirmed active exploitation and the severity of the potential impact, full root access to a network firewall security teams should treat CVE-2026-0300 as a top-priority incident response item.
Inventory all affected appliances, enforce access restrictions immediately, and monitor for indicators of compromise while tracking the official patch release schedule closely.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2026-0300, the flaw carries a CVSS 4.0 base score of 9.3 and enables unauthenticated remote attackers){kind=link}